Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
309ebd50ccdc41cfb3d905842d74e6b1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
309ebd50ccdc41cfb3d905842d74e6b1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
309ebd50ccdc41cfb3d905842d74e6b1_JaffaCakes118.html
-
Size
25KB
-
MD5
309ebd50ccdc41cfb3d905842d74e6b1
-
SHA1
77b2c3ebac40ec7bf074122db6251fc5bdea7c83
-
SHA256
28a9c0429dbe484a2dd9e70e8c9ce24e782f242656df027a4555f1e8d0a70e4c
-
SHA512
08e65918526b1c4336240e3d3892d26ea3025174b5fa95ca99cd36aee3c7e1fd6058dada5355c75e1e4d29081286cef7ea9c106cbf979bae2d59b921e509b6a4
-
SSDEEP
768:Sjb/Ym5XCQ2wX6ndPTW78DLhiF0YESs548YrMN5Ijc/Ui/a/3/w/1d/7m:SjaTW78XbnijcciyfY9dTm
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002ea1bcdc94615db7bb804ae4110957a681d1f4be72d250bc511149ffcc843e17000000000e8000000002000020000000251763e0b1515f5108eaf744ed764e5741d7e7acf3b61559cf4108a2b433a42c900000000f844a70653687962a4f41e953170e5869b5762f91edc5361de71174e3cc7c18e83a35e60e90df6d827d1d579b41d2d169716aefdd1b91c04b0a6e8de56ef045fe885d8fe720d0c5becbf53fc5791e4f91ce2dea74eb9973bbdc66a7d32bcd17da638f7c4c2a342ed7bdcee215871205a308eefcdc3afaacde6fc94837f8a806d066fd87efea701d8c239fe74ea1bfb44000000057504ccb04ff1c205324c103932f8e955defe5737ff203cef49f356e70a48627650a0d7d15a51d0512482d3f4dfcc9b3a3be4f6410f1d92dbce01d842740231a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8666B51-0F01-11EF-91CF-DEECE6B0C1A4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421530447" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003cb2c716942e4e7d960730ca431e57b75ff13bf34b20b9ec7149fed03053c720000000000e80000000020000200000009d52f13b00017612747584a1c2e0aac642bed376e1dbdb1f4ec8bfe27d07fc7a200000002ec614b70c20973b5727897a772822c1b473696ef0f523df48ad2f4c6c49945040000000b90d62d46797724ed61360075ec7de51a6c2e451d2900944a8317d96808772f148f0b182ce7c1291c6e8768afdcf56a16176ff7fdfd49a8a71b977caa3fdab94 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3004229e0ea3da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1704 2116 iexplore.exe 28 PID 2116 wrote to memory of 1704 2116 iexplore.exe 28 PID 2116 wrote to memory of 1704 2116 iexplore.exe 28 PID 2116 wrote to memory of 1704 2116 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\309ebd50ccdc41cfb3d905842d74e6b1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579d45c08ad3cb9d3c72e3deeb989d918
SHA1c476e0b06610eb0ac9d203f0c0a5b7df1429daf0
SHA25671de95687d45092ae3ee08cc40d3e801a766fc46901f722a648f0610ea111200
SHA5128129bc416fe28f3eaead13b41cbea684c55654c6b20e7a7996b501ac9c6da8567238dc3472c447a70c747c53273cb332047e77d6c51266c678d759a2168aeabf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52269e203db3a73a158ab026f81694476
SHA1ea782e838de9adfff56c8a9ecc25168d9d1d1a50
SHA2560d9461294d68bec2096ca0ade404a4eff8ba96d4ce18cb019270808cfee279f6
SHA51216dafbc69232ac2fa13f247bd81a4e00ed05fd490413d47b1693a732b7de050c6a890a89b917bf5e30022baf5f4a9408faba9abe14259fc7c0152187eee43419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad4bae7adcb8e1f02c9237c5e4264a0
SHA1e6615de0bdd56858d1099a992d28809e7fb2b294
SHA2561e4457beebf90c250b1c72993cb29cfd4f0894d92ee865d80dd7131a5c9f7bc9
SHA512f0e9bcf94a063d7d882b9e3e2f070c3f5123aeb0ec125ac34fbfcb9db0c3394ca5b8e3caf6302197f7c40761d0ef16741743a7ae979e76296a0415c09b9aaa7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5377c5bafbf110e3155ef8c9eb03a568b
SHA141130a812f9a1956c73e8897450eea6e9180d9c9
SHA2563a101040880ac02868e36e11a4a57a753879e4619469017c252d7428e7709e98
SHA512cdf2a5120454abf73628c98d35d03a83592fcb8b1db8d8f7c54c40563b20bb2e885fc99041d0f39fc5350483729f712b3155f769353a00b2d95dace9b2813b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a515ca96f65d3251aca8c232ee245bcd
SHA1087dc82047bb8c306cebebb017fa01db4d7fcfe2
SHA256fde99d08dfb3905ff4337227e4af239a812c6f72305787c72f6c1cf79e2a41dc
SHA5126698daff5d99cb0bb35215d79667189e7874d4d7596ad06ce56868154a48eeafa69bfdc4efdfd51c841019e0a926d63060a096d2251c63ee603d35e788b6aebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5fe85f06bba63da18302463540dc3bb
SHA1d4c15456d791439d9f26fb6407683ebee83024b0
SHA256ff6f93f365cd667b0258222da99d2967109e914d2b929e8e3d242e2807b2ff46
SHA512d948dbf3005af3071fcf37bfc3767436ec0a82e07d873a8cf16104d769737d2321689224e5f945ac8f39425b1dfc162dd12dc7770a9e33b16f4db16d4a0c45aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503103c2e984f64ce5b6453c49cc76f11
SHA10693bd6e2193c637889b954cf689f207ac087c41
SHA25673b97192b55bf5c04151d92eb30cb4cd8943e183aaaf20711fc521ec690c938a
SHA51262edaa14a989fe0b1ba0e45dc8ab9e95dd215621833b82de9d8ae4fead7713840aa135b28897dd7d4fb3004238c1062af5fa95da032e21d1f827f6b41cae340b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5985581f4d9bd540665d47ef5c804a495
SHA1ca314e39f7b07fc6a3f5948f107fa6b18830999a
SHA25652bcb268cae0c927e46ab34687d7dea3ef11744ff1e6cadd6817bc668fcc86c9
SHA512596abd62f1f9a80b47ab31cc268dacf56cb8bb65fc3574652c8fe27932819ef7595d60d1acfbba84e341559b0807b2cbfa8c2428a315204b2a08fed5fa544ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f5aec031e788a62f9f3b91dc1e29de8
SHA119266907e2dd8b5df5169eadcac207eae1a92838
SHA25672a43abcd3557412b2b59c890741e33ad369283e0de67aba68735fcca66ba580
SHA512420572ed69fc049dd305a8f7f6ab25fbcc134222f6a2c9b78cf53d3662efcd5a47ac75b653ff711c4d8b6658fc7ba41b17bfa7214a434ae32b19798821e31a38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a105a9ccd9a9fd723fd4fbdb34ed2e7
SHA1242f635a1cb42af324a1f978ba076d4620f4c9a4
SHA256f639d5fe2edea714b3fcf9045d824e773e563caa1b7e2ff3dc521e4f80619965
SHA51228352364019ac8836d01d5eaad2533416886d0c2a4e24763a6d22f2eb50ebc622e38f0f687d51dfb4a1589270871d93882f9c8561e8a76a5ed7d824b70237df1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a891f727e26d5b4a13747344eb94be18
SHA1e51a02bdc875013295012ea7c05b78576c7cabc5
SHA2566b1adc114bf566ab1b5474cf0f94ce99fe2de1f910af19fb89a423f7029151d1
SHA512e41bbf67c342c20b71c74e46f69e034b0d403432386268036a71c2157647274259e47e4457a6cb9926197f924384d0afe20740c0e8d13dbb01f6de0927538ee5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b152fe3a1f9a3ef63eb5b159851d288e
SHA144679b4870e9387c00be19a2c87feaa90132062a
SHA256e5bde2e5d593670ca2056cda74f4e696240dcba20fe1f8a5181cad471a863839
SHA512ed23eb65847613b854784800cd46167d2234ad62eaedb9a8e1ca1def6e6e48dbc325b5cd094df8c0dc8331a5c9d83c386df11c7f03fe354052bb023772092963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526d1dc597be874e179dd953e95dcd0c6
SHA1cf34d487f6f83fdefabf18d4c5d3428215034786
SHA256d23d48c85d8a008b5f3828f27eb04d4eceb756e6304cd67257128149f439da9e
SHA512186d02f174df44ff96cd3373877c761ce589a01237293f2dd22c34d689b56244558f276865b38689462d5d90adbd87745ebe8051a101b6f6093e501812f321bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ff3617ac8b84f861899fe7177c35de5
SHA1ca3cb2ce496ea47db74ff705df63a9e7008c7aba
SHA256e676d9cf2f907d5f7550fd7eb9b9c03f6dbae31068232feb31a2301d912d108b
SHA5127377ae9e78bcfff1446e22742011c052f354783846509f8daedd900566ddbc67b0f199c87e511ec6274349209b2cd978eaa6c2707160fe11e7a12964c47cdf1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc67ea7aa13eb93c2e89f6517a74f02c
SHA10588ce233f93921361d34dfca202e8c90d7eebc8
SHA256add55a92d2f2fc05a5a5ba1b07634f23af533cd7af9b3d812cfad7fc50e2710a
SHA512623c2a119b220518fabbe3451cb08247eadd3ee30b9ec99d6afa7b0c13e41c481d3350da697dd187f7fdc94b23707abbe2ba3460cd2194ac4c7f4f2fce5ee53f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef513e84883e037869c5df14df588a5d
SHA10b88d76fd175d282c5cfe26d19fcce503bf30193
SHA25660f93c4ada0b38959f4e811adc2d2bf3d01ff9b3b0bacc48071a351ce1680780
SHA512c650c6581daf7171f52f4317c4d9cae6b194e228d7a453c92f496a7612c6393a5f3a4487dce09c97f418de7c935ad0404cc43ae855d8901059e260ad277dc354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a0aaa954e4877f2119ad1dc288571a2
SHA18ff74024241cd2b5f9183637951fbd146677e33f
SHA25661a655fa573529fe71a9db074111d9fb3a52a7d4a3ab9980ba545d3d2f360588
SHA5121b537d4e6f740f9bb11f6694d2388e64a64c47e5d237d327374f37dfd6e033975ee383b9764560c4f269a4ad6d4e9849fe02dc6b73e02cec4fd05dd5d5f0affb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5904df0ec240cd9725261b9a795b69534
SHA15748359bee3dfd2533a292b5d4778bfeead62c3e
SHA25623ee79ac0ae5fa4cf2c7d285b151429f8e7c6bfc96cfba8d76f8b5a4934d444d
SHA512c3a84fb690275c41ccfb94e5a35e35e564124607ed0899ac5b7ca2d96edb14005460818a4c45d187457eebd4e6b0e814901465d60f712897ac89d849633d7041
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\settings[1].htm
Filesize162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a